ES|QL implicit casting
Often users will input date, date_period, time_duration, ip or version as simple strings in their queries for use in predicates, functions, or expressions. ES|QL provides type conversion functions to explicitly convert these strings into the desired data types.
Without implicit casting users must explicitly code these to_X functions in their queries, when string literals don’t match the target data types they are assigned or compared to. Here is an example of using to_datetime to explicitly perform a data type conversion.
FROM employees
| EVAL dd_ns1=date_diff("day", to_datetime("2023-12-02T11:00:00.00Z"), birth_date)
| SORT emp_no
| KEEP dd_ns1
| LIMIT 1 Implicit casting example
Implicit casting automatically converts string literals to the target data type. This allows users to specify string values for types like date, date_period, time_duration, ip and version in their queries.
The first query can be coded without calling the to_datetime function, as follows:
FROM employees
| EVAL dd_ns1=date_diff("day", "2023-12-02T11:00:00.00Z", birth_date)
| SORT emp_no
| KEEP dd_ns1
| LIMIT 1 Operations that support implicit casting
The following table details which ES|QL operations support implicit casting for different data types.
| ScalarFunctions | Operators | GroupingFunctions | AggregateFunctions | |
|---|---|---|---|---|
DATE | Y | Y | Y | N |
DATE_PERIOD/TIME_DURATION | Y | N | Y | N |
IP | Y | Y | Y | N |
VERSION | Y | Y | Y | N |
BOOLEAN | Y | Y | Y | N |
ScalarFunctions includes:
Operators includes:
© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/8.17/esql-implicit-casting.html
